Access a Vpc's Internet Gateway

[jeanblanchard]

Add an accessor to the Internet Gateway that was created by the Vpc construct.

Use Case

Trying to add a PublicSubnet to an existing Vpc (with existing public subnets), there is no way to create a route to the Vpc's existing Internet Gateway, because the reference is not exposed anywhere (that I could find), so the PublicSubnet is not effectively public.

Proposed Solution

• Either add an accessor to a VPC's internet gateway, if any
• Or have the PublicSubnet constructor automagically create the route from the VPC it's a part of.

(Or, ideally, both)

Other

I'd take a workaround within CDK, that allows this without creating (and paying for) a second IGW...

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[jeanblanchard]

Update - I found my workaround, using an escape hatch to get the "IGW" child resource in the Vpc construct:

    const igw = vpc.node.findChild('IGW') as CfnInternetGateway;
    new CfnRoute(this, 'IGW', {
      routeTableId: subnet.routeTable.routeTableId,
      destinationCidrBlock: '0.0.0.0/0',
      gatewayId: igw.ref,
    });

[SomayaB]

Glad you could figure it out! :) Closing this issue. Feel free to reopen.

[shearn89]

Having a stab at this, hope to have a PR out soon.

[deepu-james]

const igw = vpc.node.findChild('IGW') as CfnInternetGateway;

@jeanblanchard This is not working now.
const igw = existingDefaultVPC.node.findChild('IGW') as ec2.CfnInternetGateway; throws an error message "No child with id: 'IGW' at Node.findChild"
Is there a different way to get the internet gateway id from an imported VPC?

[daverickdunn]

Don't know if this is a regression, or if it was never fixed, but this still doesn't work in 1.134.0 and it previously didn't work in 1.117.0. The internetGatewayId field of Vpc is undefined when using Vpc.fromLookup. Same applies for the proposed workaround above.

[shearn89]

Hi @daverickdunn - unless it was added since I did the work on this then the PR never supported getting the IGW ID from an imported VPC, as stated in the README: I just didn't have the time to add it in since that wasn't my use case!

Still, I'm curious why the escape hatch isn't working, unless the child name has changed. I'll see if I can dig through and find out.

[daverickdunn]

@shearn89 Yep, my apologies, I should probably open a new issue for this. FWIW, I did a quick console.log of the imported node and it's children and there was nothing resembling an IGW.

[shearn89]

It looks like the VPC Context Provider in cx-api isn't actually returning the internet gateway, if I'm reading it correctly...